Government Advances Continuous Security Monitoring

DOD, DHS expect smart technologies will defend networks against common attacks, free IT personnel to deal with more dangerous threats.

DARPA Next-Gen Aircraft: Sneak Peek

(Click image for larger view and slideshow.)

US government efforts to protect computer networks with continuous data monitoring systems are beginning to make progress. By automating the detection and remediation of the most common types of cyber attacks, government official say they hope to free up the time and brain power of human IT personnel to work on the most pressing and dangerous online threats.

Both the Department of Homeland Security (DHS) and the Department of Defense (DOD) have been at the forefront of work on automated threat detection and resolution technologies. One of the key continuous monitoring and remediation systems now being deployed across the federal government is Einstein, said Phyllis Schneck, DHS deputy undersecretary for cyber security in the department's National Protection and Programs Directorate.

Speaking at a recent industry Cybersecurity Summit, Schneck said the DHS has already deployed its Einstein 3 continuous monitoring and mitigation software across its enterprise and parts of the federal government. Additional deployments will promulgate the system across the entire federal government and ultimately, participating commercial firms and owners of critical national infrastructure, Schnek said.

Einstein has been around for a while. Its first initial deployment in 2004 focused on network flow monitoring, while the program's second version provided passive intrusion detection. Once Einstein 3 is active across the government, its automated monitoring, detection, and remediation systems will allow agencies to free up their IT personnel to focus on the most vital and pressing challenges, she said.

On the DOD side, the Navy is also participating in federal continuous data monitoring programs, said Shaun Khalfan, chief of the cyber security and infrastructure team in the Navy CIO's office. Khalfan noted that, among other things, the service seeks a host-based system. Another requirement is building in asset-management capabilities from the beginning for any new systems. For example, this will be important in tracking and managing tactical networks and the machines that operate on them as they may not always be connected to the Navy and DOD's major networks, he said.

Continuous data monitoring and built-in security are also key parts of the Navy and Marine Corp's Next Generation Enterprise Network (NGEN) program. One problem with many past DOD and government IT programs is that security was often bolted on or cut due to budget concerns. Khalfan noted a NGEN goal is to "bake in" security from the beginning, at the source-code level at the earliest parts of the development cycle.

For the Marine Corps, another goal for NGEN is continuous monitoring, explained Ray Letteer, chief of the service's cybersecurity division. Detecting and mitigating threats can be a challenge for the Corps because, like the Navy, many of their tactical systems deploy and operate outside main service networks and then plug in, either remotely or when the equipment returns to base.

The Marine Corps recently deployed a new system that automatically scans and remediates any new equipment being activated on a base. Letteer described a test at Camp Lejeune in North Carolina where a commercial laptop was activated on site. Within 45 seconds, the system had scanned it and alerted base IT staff that the device was noncompliant with DOD security standards. He noted that such systems allow the military to free up IT staff to work on more challenging and critical issues.

The software compliance/detection system is scheduled to be deployed across the Marine Corps by this December, he said.

NIST's cyber-security framework gives critical-infrastructure operators a new tool to assess readiness. But will operators put this voluntary framework to work? Read the Protecting Critical Infrastructure issue of InformationWeek Government today.

Henry Kenyon is a contributing writer to InformationWeek Government. He has covered Government IT and Defense markets since 1999 for a variety of publications including Government Computer News, Federal Computer Week, AFCEA's Signal Magazine and AOL Government. View Full Bio

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.

I agree with you @christianabryant. Technology via scans and similar techniques can only perform so much. All defense in depth strategies I have seen list scans and automation as the only a subset of what is needed for a SOC or security initiative. Heavy analysis, which is mostly a human performed action aside from heuristics is crucial in detecting malicious activity. Even with honed ids/ips systems we frequently see false positives, and these are filtered out by people. I believe when ever there is an analytical counterpart to be seen, humans will always have a seat at the table.

I'm all for this and support the initiatives. But we can never let real humans forget that we're all here for a reason, whatever our role in security and configuration management may be. That is, automated scanners and intrusion detection systems, the whole lot of automated security software, isn't the whole solution. If it were, we'd all be out of jobs. System and application crackers and crews would get real 9 to 5 jobs. Is that only because automation is just a facet of a larger security solution? I actually think not. I think it's because automation has inherent issues due to human predictability patterns and the way your average hacker and cracker code, or don't (social hacking).

Continuous data monitoring and built-in security are successful as long as there is adaptation to handle the methodologies of today's hacker. And that can change day-to-day. Folks often associate the tools of hackers and crackers with the sets often found on distributions like Kali Linux. But it's not that simple, and many cyber criminals don't even touch those tools. To say that monitoring data can free up IT staff is like saying setting a camera on a group of kids in daycare frees up the daycare employees to do other work. You're going to end up with a missing kid before long. The human element of hacking is what makes so many cyber criminals successful. You must assume that normal as well as abnormal activity surroundnig data should be observed, and against the normal activity, another layer of algorithms, checks and balances needs to be applied.

As good as the tools may be, I believe little defense can be had against uber-hackers (working from low-tech to high-tech) and all-out assaults on a network, is high reliance is put upon the tools. We must be more diligent in our design of precious data stores and how applications access that data. You can't hack what you can't see is a popular catch-phrase, and go figure, it happens to be true. Of course, what that "other work" is the IT folks are doing could determine the success of the security model that includes these tools, but only if it addresses what the tools do and can not.

At its core, digital business relies on strong security practices. In addition, leveraging security intelligence and integrating security with operations and developer teams can help organizations push the boundaries of innovation.